Vulnerability · Published Sep 15, 2025 · Assigned by GitHub_M

CVE-2025-59056FreePBX vulnerable to unauthenticated Denial of Service

Medium 6.6

In plain English

A medium-severity path traversal in framework from FreePBX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)6.6Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.

Affected products (as reported)

Vendor	Product	Versions
FreePBX	framework	< 15.0.38>= 16.0.0, < 16.0.41>= 17.0.0, < 17.0.21

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:L/U:Red

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-frc2-jhgg-rwpr x_refsource_CONFIRM
https://github.com/FreePBX/framework/blame/release/17.0/amp_conf/htdocs/admin/ajax.php#L18 x_refsource_MISC